A known General Packet Radio System (GPRS) mobile communication system comprises so-called GSN (GPRS Support Node) nodes which route packet information between the Internet and radio base stations. The WPP(Wireless Packet Platform)-based GSN nodes contain different kinds of processing boards, with or without off-line storage capacity. In case the board has no off-line storage capacity (e.g. hard disc), the board must somehow be booted remotely from another board via the node internal TCP/IP network. The boards/processors responsible for booting other boards are named NCB's, which is an acronym for Node Control Boards, as they also fill this function. The boot process involves the transfer of files between the NCB and the boards to be booted. The boards are connected via a TCP/IP network running over an Ethernet.
The above networks have the intrinsic property that they allow third parties to listen to all traffic that passes over the network. Hence, somebody may eavesdrop on the conversation between two parties A and B that communicate over the network. This problem is off course known from many other communication systems and situations.
An attacker that has gained access to the internal network can thus listen to traffic that passes between two boards, thus breaking confidentiality of the data. The attacker can initiate traffic to a board, posing as someone else, in effect lying about his credentials, thus breaking the authentication property between parties. The attacker can also inject traffic in communication that is ongoing, in effect altering the traffic, thus breaking integrity of the data.
Cryptographic methods are typically employed to solve the above kind of problems. However, they come at a cost in processing power and processing time, for example for encrypting/decrypting a file or calculating elaborate checksums. Moreover, they typically result in many extra messages/roundtrips over the network. FTP (File Transfer Protocol) messages over IPsec (IP security protocol)/IKE (Internet Key Exchange) is one example of relatively complex security routines.